#include <stdio.h>
#include <pcap.h>
#include <netinet/in.h>
#include <netinet/if_ether.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <time.h>

#define SIZE_ETHERNET 14
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)

void packet_handler(u_char *args, const struct pcap_pkthdr *header, const struct pcap_packet *packet) {
    static int total_bytes = 0;
    static int interval = 5;
    static time_t start_time = 0;

    struct ip *ip_header;
    struct tcphdr *tcp_header;
    int size_ip;
    int size_tcp;
    time_t packet_time = header->ts.tv_sec;

    if (start_time == 0) {
        start_time = packet_time;
    }

    // Check time interval
    if (packet_time - start_time >= interval) {
        printf("Traffic from port 80 in the last %d seconds: %d bytes\n", interval, total_bytes);
        total_bytes = 0;
        start_time = packet_time;
    }

    const struct ether_header *ethernet_header;
    ethernet_header = (struct ether_header*)(packet);
    
    if (ntohs(ethernet_header->ether_type) == ETHERTYPE_IP) {
        ip_header = (struct ip*)(packet + SIZE_ETHERNET);
        size_ip = IP_HL(ip_header)*4;
        
        if (ip_header->ip_p == IPPROTO_TCP) {
            tcp_header = (struct tcphdr*)(packet + SIZE_ETHERNET + size_ip);
            size_tcp = TH_OFF(tcp_header)*4;
            
            if (ntohs(tcp_header->th_sport) == 80) {
                total_bytes += header->len;
            }
        }
    }
}

int main(int argc, char *argv[]) {
    char *dev, errbuf[PCAP_ERRBUF_SIZE];
    pcap_t *handle;
    struct bpf_program fp;
    char filter_exp[] = "tcp and src port 80";
    bpf_u_int32 mask;
    bpf_u_int32 net;

    if (argc != 2) {
        fprintf(stderr, "Usage: %s <pcap file>\n", argv[0]);
        return(2);
    }

    handle = pcap_open_offline(argv[1], errbuf);
    if (handle == NULL) {
        fprintf(stderr, "Couldn't open pcap file %s: %s\n", argv[1], errbuf);
        return(2);
    }

    if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
        fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
        return(2);
    }

    if (pcap_setfilter(handle, &fp) == -1) {
        fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
        return(2);
    }

    pcap_loop(handle, 0, packet_handler, NULL);

    pcap_freecode(&fp);
    pcap_close(handle);

    return(0);
}








#include <stdio.h>
#include <pcap.h>
#include <netinet/in.h>
#include <netinet/if_ether.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>

#define SIZE_ETHERNET 14
#define IP_HL(ip) (((ip)->ip_vhl) & 0x0f)
#define TH_OFF(th) (((th)->th_offx2 & 0xf0) >> 4)

void packet_handler(u_char *args, const struct pcap_pkthdr *header, const struct pcap_packet *packet) {
    static int total_bytes = 0;
    static time_t last_check = 0;  // Track the last time we checked
    static const int interval = 5; // 5 seconds interval

    // Calculate current packet's timestamp (seconds part)
    time_t current_time = header->ts.tv_sec;

    // If the current packet time is beyond the last check time + interval, print and reset
    if (current_time >= last_check + interval) {
        printf("Traffic from port 80 from %ld to %ld: %d bytes\n", last_check, last_check + interval, total_bytes);
        total_bytes = 0; // Reset the byte count for the next interval
        last_check = current_time; // Update last check time
    }

    const struct ether_header *ethernet_header;
    ethernet_header = (struct ether_header*)(packet);

    if (ntohs(ethernet_header->ether_type) == ETHERTYPE_IP) {
        const struct ip *ip_header = (struct ip*)(packet + SIZE_ETHERNET);
        int size_ip = IP_HL(ip_header)*4;

        if (ip_header->ip_p == IPPROTO_TCP) {
            const struct tcphdr *tcp_header = (struct tcphdr*)(packet + SIZE_ETHERNET + size_ip);

            if (ntohs(tcp_header->th_sport) == 80) {
                total_bytes += header->len;
            }
        }
    }
}

int main(int argc, char *argv[]) {
    char *dev, errbuf[PCAP_ERRBUF_SIZE];
    pcap_t *handle;
    struct bpf_program fp;
    char filter_exp[] = "tcp and src port 80";
    bpf_u_int32 mask;
    bpf_u_int32 net;

    if (argc != 2) {
        fprintf(stderr, "Usage: %s <pcap file>\n", argv[0]);
        return 2;
    }

    handle = pcap_open_offline(argv[1], errbuf);
    if (handle == NULL) {
        fprintf(stderr, "Couldn't open pcap file %s: %s\n", argv[1], errbuf);
        return 2;
    }

    if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
        fprintf(stderr, "Couldn't parse filter %s: %s\n", filter_exp, pcap_geterr(handle));
        return 2;
    }

    if (pcap_setfilter(handle, &fp) == -1) {
        fprintf(stderr, "Couldn't install filter %s: %s\n", filter_exp, pcap_geterr(handle));
        return 2;
    }

    pcap_loop(handle, 0, packet_handler, NULL);

    pcap_freecode(&fp);
    pcap_close(handle);

    return 0;
}




import pyshark
import time

def analyze_pcap(file_name):
    cap = pyshark.FileCapture(file_name, display_filter='tcp.srcport == 80')
    byte_count = 0
    interval = 5
    start_time = None

    for packet in cap:
        if start_time is None:
            start_time = float(packet.sniff_timestamp)

        if float(packet.sniff_timestamp) >= start_time + interval:
            print(f"Traffic from port 80 from {start_time} to {start_time + interval}: {byte_count} bytes")
            start_time += interval
            byte_count = 0

        byte_count += int(packet.length)

    # Final interval if any remains
    if byte_count > 0:
        print(f"Traffic from port 80 from {start_time} to {start_time + interval}: {byte_count} bytes")

    cap.close()

analyze_pcap('your_pcap_file.pcap')


#include <stdio.h>
#include <stdint.h>

struct pcap_hdr_s {
    uint32_t magic_number;
    uint16_t version_major;
    uint16_t version_minor;
    int32_t  thiszone;
    uint32_t sigfigs;
    uint32_t snaplen;
    uint32_t network;
};

struct pcaprec_hdr_s {
    uint32_t ts_sec;
    uint32_t ts_usec;
    uint32_t incl_len;
    uint32_t orig_len;
};

struct ip_hdr_s {
    uint8_t  ver_ihl;
    uint8_t  type_of_service;
    uint16_t total_length;
    uint16_t identification;
    uint16_t flags_offset;
    uint8_t  ttl;
    uint8_t  protocol;
    uint16_t checksum;
    uint32_t src_addr;
    uint32_t dest_addr;
};

struct tcp_hdr_s {
    uint16_t src_port;
    uint16_t dest_port;
    uint32_t sequence_number;
    uint32_t ack_number;
    uint8_t  offset_reserved;
    uint8_t  tcp_flags;
    uint16_t window;
    uint16_t checksum;
    uint16_t urgent_pointer;
};

void analyze_pcap(const char *filename) {
    FILE *fp = fopen(filename, "rb");
    if (!fp) {
        printf("Failed to open file\n");
        return;
    }

    struct pcap_hdr_s file_header;
    fread(&file_header, sizeof(struct pcap_hdr_s), 1, fp);

    struct pcaprec_hdr_s packet_header;
    struct ip_hdr_s ip_header;
    struct tcp_hdr_s tcp_header;
    uint8_t buffer[65535]; // Temporary buffer for packet data

    while (fread(&packet_header, sizeof(struct pcaprec_hdr_s), 1, fp) == 1) {
        if (fread(buffer, 1, packet_header.incl_len, fp) != packet_header.incl_len) {
            break; // Failed to read the complete packet
        }

        // Assuming Ethernet II frame without VLAN tagging
        ip_header = *(struct ip_hdr_s *)(buffer + 14);
        if (ip_header.protocol == 6) { // TCP protocol number is 6
            tcp_header = *(struct tcp_hdr_s *)(buffer + 14 + (ip_header.ver_ihl & 0x0F) * 4);

            if (ntohs(tcp_header.src_port) == 80) {
                // Here we could add logic to count bytes or packets
                printf("Packet from TCP port 80 captured, size: %u bytes\n", packet_header.orig_len);
            }
        }
    }

    fclose(fp);
}

int main(int argc, char *argv[]) {
    if (argc < 2) {
        printf("Usage: %s <pcap file>\n", argv[0]);
        return 1;
    }

    analyze_pcap(argv[1]);
    return 0;
}


#include <stdio.h>
#include <stdint.h>
#include <arpa/inet.h>  // For ntohs and ntohl

struct pcap_hdr_s {
    uint32_t magic_number;
    uint16_t version_major;
    uint16_t version_minor;
    int32_t  thiszone;
    uint32_t sigfigs;
    uint32_t snaplen;
    uint32_t network;
};

struct pcaprec_hdr_s {
    uint32_t ts_sec;   // Timestamp seconds
    uint32_t ts_usec;  // Timestamp microseconds
    uint32_t incl_len;
    uint32_t orig_len;
};

struct ip_hdr_s {
    uint8_t  ver_ihl;
    uint8_t  type_of_service;
    uint16_t total_length;
    uint16_t identification;
    uint16_t flags_offset;
    uint8_t  ttl;
    uint8_t  protocol;
    uint16_t checksum;
    uint32_t src_addr;
    uint32_t dest_addr;
};

struct tcp_hdr_s {
    uint16_t src_port;
    uint16_t dest_port;
    uint32_t sequence_number;
    uint32_t ack_number;
    uint8_t  offset_reserved;
    uint8_t  tcp_flags;
    uint16_t window;
    uint16_t checksum;
    uint16_t urgent_pointer;
};

void analyze_pcap(const char *filename) {
    FILE *fp = fopen(filename, "rb");
    if (!fp) {
        printf("Failed to open file\n");
        return;
    }

    struct pcap_hdr_s file_header;
    fread(&file_header, sizeof(struct pcap_hdr_s), 1, fp);

    struct pcaprec_hdr_s packet_header;
    uint8_t buffer[65536]; // Temporary buffer for packet data

    uint32_t current_time = 0;
    uint32_t next_interval = 5; // 5 seconds interval
    uint32_t byte_count = 0;

    while (fread(&packet_header, sizeof(struct pcaprec_hdr_s), 1, fp) == 1) {
        if (packet_header.ts_sec >= current_time + next_interval) {
            printf("Traffic from port 80 from %u to %u: %u bytes\n", current_time, current_time + next_interval, byte_count);
            current_time += next_interval;
            byte_count = 0; // Reset byte count for next interval
        }

        if (fread(buffer, 1, packet_header.incl_len, fp) != packet_header.incl_len) {
            break; // Failed to read the complete packet
        }

        // Assuming Ethernet II frame without VLAN tagging
        struct ip_hdr_s *ip_header = (struct ip_hdr_s *)(buffer + 14);
        if (ip_header->protocol == 6) { // TCP protocol
            struct tcp_hdr_s *tcp_header = (struct tcp_hdr_s *)((uint8_t *)ip_header + (ip_header->ver_ihl & 0x0F) * 4);
            if (ntohs(tcp_header->src_port) == 80) {
                byte_count += packet_header.orig_len;
            }
        }
    }

    if (byte_count > 0) {
        printf("Traffic from port 80 from %u to %u: %u bytes\n", current_time, current_time + next_interval, byte_count);
    }

    fclose(fp);
}

int main(int argc, char *argv[]) {
    if (argc < 2) {
        printf("Usage: %s <pcap file>\n", argv[0]);
        return 1;
    }

    analyze_pcap(argv[1]);
    return 0;
}


gcc -o your_program your_program.c -lpcap -static
